CVE-2026-7445

· MEDIUMDeferred

← All CVEs

CVSS v3.1

6.3

CVSS v4.0

2.1

EPSS

0.29%

Published

Apr 29, 2026

Modified

Apr 30, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2. Affected by this issue is some unknown functionality of the file src/managers/ResourceManager.ts of the component MCP Log Resource Handler. The manipulation of the argument dirname leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-22

References (6)

https://github.com/BruceJqs/public_exp/issues/23

https://github.com/ZachHandley/ZMCPTools/

https://github.com/ZachHandley/ZMCPTools/issues/8

https://vuldb.com/submit/804058

https://vuldb.com/vuln/360186

https://vuldb.com/vuln/360186/cti

KEV Catalog EPSS Scores Vendors All CVEs